Warning: Permanently added '10.128.1.98' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://43035 [ 31.028528][ T4723] cgroup: Unknown subsys name 'net' [ 31.188606][ T4723] cgroup: Unknown subsys name 'cpuset' [ 31.189981][ T4723] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.335997][ T4723] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.020068][ T4730] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.112123][ T4740] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.112445][ T4740] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.112606][ T4740] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.112941][ T4740] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.113156][ T4740] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.710785][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.710800][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.723285][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.723297][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.992536][ T4770] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.992867][ T4770] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.992934][ T4770] bridge_slave_0: entered allmulticast mode [ 34.993376][ T4770] bridge_slave_0: entered promiscuous mode [ 34.994718][ T4770] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.994762][ T4770] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.994817][ T4770] bridge_slave_1: entered allmulticast mode [ 34.995206][ T4770] bridge_slave_1: entered promiscuous mode [ 35.002203][ T4770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.003003][ T4770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.008950][ T4770] team0: Port device team_slave_0 added [ 35.009668][ T4770] team0: Port device team_slave_1 added [ 35.015759][ T4770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.015768][ T4770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.015779][ T4770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.016518][ T4770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.016526][ T4770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.016541][ T4770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.025946][ T4770] hsr_slave_0: entered promiscuous mode [ 35.026254][ T4770] hsr_slave_1: entered promiscuous mode [ 35.080303][ T4770] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.082205][ T4770] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 35.082636][ T4770] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.083691][ T4770] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 35.084049][ T4770] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.084917][ T4770] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 35.085255][ T4770] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.086660][ T4770] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 35.096178][ T4770] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.096208][ T4770] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.096358][ T4770] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.096388][ T4770] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.130649][ T4770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.134629][ T3298] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.135055][ T3298] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.138694][ T4770] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.142294][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.142323][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.149427][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.149450][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.156795][ T4770] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 35.156810][ T4770] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 35.242215][ T4770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.253595][ T4770] veth0_vlan: entered promiscuous mode [ 35.256972][ T4770] veth1_vlan: entered promiscuous mode [ 35.266848][ T4770] veth0_macvtap: entered promiscuous mode [ 35.271180][ T4770] veth1_macvtap: entered promiscuous mode [ 35.275992][ T4770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.279136][ T4770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.282838][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.283190][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.283251][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.297939][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.372381][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.436826][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.490378][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.531532][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:35 executed programs: 0 [ 35.786998][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.787587][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.787988][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.788323][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.788536][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.915048][ T4825] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.915104][ T4825] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.915154][ T4825] bridge_slave_0: entered allmulticast mode [ 35.915556][ T4825] bridge_slave_0: entered promiscuous mode [ 35.916408][ T4825] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.916451][ T4825] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.916532][ T4825] bridge_slave_1: entered allmulticast mode [ 35.916939][ T4825] bridge_slave_1: entered promiscuous mode [ 35.924762][ T4825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.925599][ T4825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.932320][ T4825] team0: Port device team_slave_0 added [ 35.933071][ T4825] team0: Port device team_slave_1 added [ 35.940089][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.940099][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.940113][ T4825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.940604][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.940611][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.940622][ T4825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.950655][ T4825] hsr_slave_0: entered promiscuous mode [ 35.950932][ T4825] hsr_slave_1: entered promiscuous mode [ 35.951122][ T4825] debugfs: 'hsr0' already exists in 'hsr' [ 35.951170][ T4825] Cannot create hsr debugfs directory [ 37.867445][ T4740] Bluetooth: hci0: command tx timeout [ 38.579756][ T12] bridge_slave_1: left allmulticast mode [ 38.579781][ T12] bridge_slave_1: left promiscuous mode [ 38.580025][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.581824][ T12] bridge_slave_0: left allmulticast mode [ 38.581836][ T12] bridge_slave_0: left promiscuous mode [ 38.581898][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.636775][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.668389][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.679775][ T12] bond0 (unregistering): Released all slaves [ 38.741426][ T12] hsr_slave_0: left promiscuous mode [ 38.741726][ T12] hsr_slave_1: left promiscuous mode [ 38.742013][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.742028][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.742394][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.742404][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.745620][ T12] veth1_macvtap: left promiscuous mode [ 38.745652][ T12] veth0_macvtap: left promiscuous mode [ 38.745697][ T12] veth1_vlan: left promiscuous mode [ 38.745736][ T12] veth0_vlan: left promiscuous mode [ 38.847402][ T12] team0 (unregistering): Port device team_slave_1 removed [ 38.851018][ T12] team0 (unregistering): Port device team_slave_0 removed [ 38.896977][ T4399] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.099420][ T4825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.100762][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.101142][ T4825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.102204][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.102539][ T4825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.103421][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.103787][ T4825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.104564][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.142372][ T4825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.145209][ T4825] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.149274][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.149298][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.164576][ T4825] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.164593][ T4825] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.165410][ T3298] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.165431][ T3298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.355524][ T4825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.370225][ T4825] veth0_vlan: entered promiscuous mode [ 39.373612][ T4825] veth1_vlan: entered promiscuous mode [ 39.386903][ T4825] veth0_macvtap: entered promiscuous mode [ 39.391974][ T4825] veth1_macvtap: entered promiscuous mode [ 39.395221][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.396749][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.417673][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.417684][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.423548][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.423564][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.428865][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.429184][ T3298] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.429203][ T3298] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.447963][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.452842][ T4917] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 39.452860][ T4917] CPU: 1 UID: 0 PID: 4917 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 39.452869][ T4917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 39.452874][ T4917] Call trace: [ 39.452877][ T4917] show_stack+0x2c/0x3c (C) [ 39.452895][ T4917] __dump_stack+0x30/0x40 [ 39.452908][ T4917] dump_stack_lvl+0xd8/0x12c [ 39.452917][ T4917] dump_stack+0x1c/0x28 [ 39.452927][ T4917] dump_header+0xbc/0x3f0 [ 39.452934][ T4917] oom_kill_process+0x248/0x864 [ 39.452943][ T4917] out_of_memory+0xd24/0x1064 [ 39.452950][ T4917] mem_cgroup_out_of_memory+0xe8/0x170 [ 39.452960][ T4917] try_charge_memcg+0x9bc/0xd38 [ 39.452966][ T4917] obj_cgroup_charge_pages+0x44/0xc8 [ 39.452978][ T4917] __memcg_slab_post_alloc_hook+0x498/0x824 [ 39.452988][ T4917] kmem_cache_alloc_lru_noprof+0x32c/0x5d8 [ 39.452996][ T4917] alloc_inode+0x84/0x198 [ 39.453007][ T4917] new_inode+0x20/0x50 [ 39.453017][ T4917] gadgetfs_make_inode+0x34/0x18c [ 39.453028][ T4917] gadgetfs_create_file+0x48/0xd8 [ 39.453037][ T4917] gadgetfs_bind+0x3f8/0x75c [ 39.453047][ T4917] gadget_bind_driver+0x274/0x834 [ 39.453056][ T4917] really_probe+0x29c/0x800 [ 39.453064][ T4917] __driver_probe_device+0x1e0/0x350 [ 39.453071][ T4917] driver_probe_device+0x6c/0x19c [ 39.453078][ T4917] __driver_attach+0x168/0x384 [ 39.453085][ T4917] bus_for_each_dev+0x128/0x1b4 [ 39.453095][ T4917] driver_attach+0x50/0x60 [ 39.453102][ T4917] bus_add_driver+0x208/0x500 [ 39.453111][ T4917] driver_register+0x220/0x310 [ 39.453118][ T4917] usb_gadget_register_driver_owner+0xf0/0x25c [ 39.453127][ T4917] dev_config+0x91c/0xcc0 [ 39.453136][ T4917] vfs_write+0x2a4/0xa0c [ 39.453144][ T4917] ksys_write+0x12c/0x228 [ 39.453150][ T4917] __arm64_sys_write+0x84/0x98 [ 39.453157][ T4917] invoke_syscall+0x98/0x244 [ 39.453167][ T4917] el0_svc_common+0xec/0x23c [ 39.453177][ T4917] do_el0_svc+0x4c/0x5c [ 39.453186][ T4917] el0_svc+0x60/0x1d8 [ 39.453197][ T4917] el0t_64_sync_handler+0x44/0x104 [ 39.453207][ T4917] el0t_64_sync+0x198/0x19c [ 39.453217][ T4917] memory: usage 0kB, limit 0kB, failcnt 19 [ 39.453222][ T4917] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 39.453227][ T4917] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 39.453232][ T4917] Memory cgroup stats for /syz0/test: [ 39.453293][ T4917] cache 0 [ 39.453297][ T4917] rss 0 [ 39.453300][ T4917] rss_huge 0 [ 39.453303][ T4917] shmem 0 [ 39.453306][ T4917] mapped_file 0 [ 39.453309][ T4917] dirty 0 [ 39.453312][ T4917] writeback 0 [ 39.453315][ T4917] workingset_refault_anon 0 [ 39.453318][ T4917] workingset_refault_file 0 [ 39.453321][ T4917] swap 0 [ 39.453324][ T4917] swapcached 0 [ 39.453327][ T4917] pgpgin 0 [ 39.453330][ T4917] pgpgout 0 [ 39.453333][ T4917] pgfault 0 [ 39.453336][ T4917] pgmajfault 0 [ 39.453339][ T4917] inactive_anon 0 [ 39.453342][ T4917] active_anon 0 [ 39.453344][ T4917] inactive_file 0 [ 39.453347][ T4917] active_file 0 [ 39.453350][ T4917] unevictable 0 [ 39.453353][ T4917] hierarchical_memory_limit 0 [ 39.453357][ T4917] hierarchical_memsw_limit 9223372036854771712 [ 39.453360][ T4917] total_cache 0 [ 39.453363][ T4917] total_rss 0 [ 39.453366][ T4917] total_rss_huge 0 [ 39.453369][ T4917] total_shmem 0 [ 39.453372][ T4917] total_mapped_file 0 [ 39.453375][ T4917] total_dirty 0 [ 39.453378][ T4917] total_writeback 0 [ 39.453381][ T4917] total_workingset_refault_anon 0 [ 39.453384][ T4917] total_workingset_refault_file 0 [ 39.453387][ T4917] total_swap 0 [ 39.453390][ T4917] total_swapcached 0 [ 39.453393][ T4917] total_pgpgin 0 [ 39.453396][ T4917] total_pgpgout 0 [ 39.453399][ T4917] total_pgfault 0 [ 39.453402][ T4917] total_pgmajfault 0 [ 39.453405][ T4917] total_inactive_anon 0 [ 39.453408][ T4917] total_active_anon 0 [ 39.453411][ T4917] total_inactive_file 0 [ 39.453414][ T4917] total_active_file 0 [ 39.453417][ T4917] total_unevictable 0 [ 39.453420][ T4917] anon_cost 0 [ 39.453423][ T4917] file_cost 0 [ 39.453427][ T4917] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4917,uid=0 [ 39.453500][ T4917] Memory cgroup out of memory: Killed process 4917 (syz.0.17) total-vm:44816kB, anon-rss:1296kB, file-rss:1040kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 39.456740][ T4917] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 39.456752][ T4917] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 39.456930][ T4917] gadgetfs expected dummy_udc controller not usbip-vudc [ 39.456938][ T4917] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 39.462978][ T4917] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 39.472741][ T4918] ================================================================== [ 39.472749][ T4918] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 39.472762][ T4918] Read of size 1 at addr ffff0000d1bdd818 by task syz.0.18/4918 [ 39.472769][ T4918] [ 39.472773][ T4918] CPU: 0 UID: 0 PID: 4918 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 39.472781][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 39.472786][ T4918] Call trace: [ 39.472788][ T4918] show_stack+0x2c/0x3c (C) [ 39.472800][ T4918] __dump_stack+0x30/0x40 [ 39.472810][ T4918] dump_stack_lvl+0xd8/0x12c [ 39.472819][ T4918] print_address_description+0xb0/0x238 [ 39.472827][ T4918] print_report+0x68/0x84 [ 39.472834][ T4918] kasan_report+0x8c/0xc4 [ 39.472842][ T4918] __kasan_check_byte+0x3c/0x54 [ 39.472850][ T4918] lock_acquire+0xa4/0x320 [ 39.472858][ T4918] _raw_spin_lock_irq+0x58/0x70 [ 39.472865][ T4918] gadget_dev_open+0x50/0x1c4 [ 39.472875][ T4918] do_dentry_open+0x5c4/0xfbc [ 39.472885][ T4918] vfs_open+0x44/0x2dc [ 39.472894][ T4918] path_openat+0x1084/0x18f0 [ 39.472903][ T4918] do_file_open+0x1c8/0x2e8 [ 39.472911][ T4918] do_sys_openat2+0x114/0x1e8 [ 39.472920][ T4918] do_sys_open+0xb0/0xe0 [ 39.472929][ T4918] __arm64_sys_openat+0xa8/0xc4 [ 39.472938][ T4918] invoke_syscall+0x98/0x244 [ 39.472948][ T4918] el0_svc_common+0xec/0x23c [ 39.472957][ T4918] do_el0_svc+0x4c/0x5c [ 39.472966][ T4918] el0_svc+0x60/0x1d8 [ 39.472977][ T4918] el0t_64_sync_handler+0x44/0x104 [ 39.472987][ T4918] el0t_64_sync+0x198/0x19c [ 39.472994][ T4918] [ 39.472996][ T4918] Allocated by task 4825: [ 39.473000][ T4918] kasan_save_track+0x40/0x78 [ 39.473007][ T4918] kasan_save_alloc_info+0x40/0x50 [ 39.473014][ T4918] __kasan_kmalloc+0x9c/0xb4 [ 39.473020][ T4918] __kmalloc_cache_noprof+0x2f4/0x5fc [ 39.473027][ T4918] gadgetfs_fill_super+0x19c/0x370 [ 39.473035][ T4918] vfs_get_super+0xb8/0x148 [ 39.473041][ T4918] get_tree_single+0x30/0x40 [ 39.473048][ T4918] gadgetfs_get_tree+0x28/0x38 [ 39.473055][ T4918] vfs_get_tree+0x90/0x28c [ 39.473062][ T4918] fc_mount+0x24/0xac [ 39.473068][ T4918] do_new_mount+0x2a4/0x538 [ 39.473076][ T4918] path_mount+0x5f0/0xa88 [ 39.473083][ T4918] do_mount+0xe8/0x148 [ 39.473090][ T4918] __arm64_sys_mount+0x33c/0x388 [ 39.473097][ T4918] invoke_syscall+0x98/0x244 [ 39.473105][ T4918] el0_svc_common+0xec/0x23c [ 39.473113][ T4918] do_el0_svc+0x4c/0x5c [ 39.473121][ T4918] el0_svc+0x60/0x1d8 [ 39.473129][ T4918] el0t_64_sync_handler+0x44/0x104 [ 39.473137][ T4918] el0t_64_sync+0x198/0x19c [ 39.473142][ T4918] [ 39.473144][ T4918] Freed by task 4917: [ 39.473147][ T4918] kasan_save_track+0x40/0x78 [ 39.473153][ T4918] kasan_save_free_info+0x54/0x6c [ 39.473160][ T4918] __kasan_slab_free+0x74/0xa4 [ 39.473166][ T4918] kfree+0x188/0x658 [ 39.473171][ T4918] put_dev+0x8c/0xf8 [ 39.473178][ T4918] dev_release+0x100/0x15c [ 39.473186][ T4918] __fput+0x338/0x74c [ 39.473191][ T4918] ____fput+0x20/0x30 [ 39.473197][ T4918] task_work_run+0x1cc/0x25c [ 39.473206][ T4918] do_exit+0x58c/0x1a74 [ 39.473214][ T4918] do_group_exit+0x198/0x238 [ 39.473219][ T4918] get_signal+0xfb0/0x1094 [ 39.473225][ T4918] arch_do_signal_or_restart+0x288/0x444c [ 39.473233][ T4918] exit_to_user_mode_loop+0x70/0x17c [ 39.473241][ T4918] el0_svc+0x12c/0x1d8 [ 39.473249][ T4918] el0t_64_sync_handler+0x44/0x104 [ 39.473258][ T4918] el0t_64_sync+0x198/0x19c [ 39.473263][ T4918] [ 39.473264][ T4918] The buggy address belongs to the object at ffff0000d1bdd800 [ 39.473264][ T4918] which belongs to the cache kmalloc-1k of size 1024 [ 39.473270][ T4918] The buggy address is located 24 bytes inside of [ 39.473270][ T4918] freed 1024-byte region [ffff0000d1bdd800, ffff0000d1bddc00) [ 39.473276][ T4918] [ 39.473278][ T4918] The buggy address belongs to the physical page: [ 39.473282][ T4918] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111bd8 [ 39.473288][ T4918] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.473294][ T4918] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 39.473301][ T4918] page_type: f5(slab) [ 39.473307][ T4918] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 39.473313][ T4918] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 39.473319][ T4918] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 39.473324][ T4918] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 39.473329][ T4918] head: 05ffc00000000003 fffffdffc346f601 00000000ffffffff 00000000ffffffff [ 39.473334][ T4918] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 39.473338][ T4918] page dumped because: kasan: bad access detected [ 39.473340][ T4918] [ 39.473342][ T4918] Memory state around the buggy address: [ 39.473345][ T4918] ffff0000d1bdd700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.473349][ T4918] ffff0000d1bdd780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.473354][ T4918] >ffff0000d1bdd800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.473357][ T4918] ^ [ 39.473360][ T4918] ffff0000d1bdd880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.473364][ T4918] ffff0000d1bdd900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.473367][ T4918] ================================================================== [ 39.473370][ T4918] Disabling lock debugging due to kernel taint [ 39.473373][ T4918] ------------[ cut here ]------------ [ 39.473375][ T4918] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 39.473381][ T4918] index 13133 is out of range for type 'unsigned long[8]' [ 39.473386][ T4918] CPU: 0 UID: 0 PID: 4918 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 39.473395][ T4918] Tainted: [B]=BAD_PAGE [ 39.473397][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 39.473400][ T4918] Call trace: [ 39.473402][ T4918] show_stack+0x2c/0x3c (C) [ 39.473412][ T4918] __dump_stack+0x30/0x40 [ 39.473421][ T4918] dump_stack_lvl+0xd8/0x12c [ 39.473430][ T4918] dump_stack+0x1c/0x28 [ 39.473439][ T4918] ubsan_epilogue+0x14/0x48 [ 39.473447][ T4918] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 39.473458][ T4918] queued_spin_lock_slowpath+0x834/0xb5c [ 39.473465][ T4918] do_raw_spin_lock+0x21c/0x2d0 [ 39.473474][ T4918] _raw_spin_lock_irq+0x60/0x70 [ 39.473480][ T4918] gadget_dev_open+0x50/0x1c4 [ 39.473489][ T4918] do_dentry_open+0x5c4/0xfbc [ 39.473498][ T4918] vfs_open+0x44/0x2dc [ 39.473507][ T4918] path_openat+0x1084/0x18f0 [ 39.473515][ T4918] do_file_open+0x1c8/0x2e8 [ 39.473523][ T4918] do_sys_openat2+0x114/0x1e8 [ 39.473532][ T4918] do_sys_open+0xb0/0xe0 [ 39.473541][ T4918] __arm64_sys_openat+0xa8/0xc4 [ 39.473556][ T4918] invoke_syscall+0x98/0x244 [ 39.473566][ T4918] el0_svc_common+0xec/0x23c [ 39.473575][ T4918] do_el0_svc+0x4c/0x5c [ 39.473586][ T4918] el0_svc+0x60/0x1d8 [ 39.473596][ T4918] el0t_64_sync_handler+0x44/0x104 [ 39.473605][ T4918] el0t_64_sync+0x198/0x19c [ 39.473612][ T4918] ---[ end trace ]--- [ 39.947056][ T4740] Bluetooth: hci0: command tx timeout [ 42.027072][ T4740] Bluetooth: hci0: command tx timeout [ 44.107145][ T4740] Bluetooth: hci0: command tx timeout